
vCISO | Published Author | CCP, CISSP, CISM, CRISC, CISA, CCSP. Expertly building resilient security cultures & managing risk. #CISO #InfoSec #Cybersecurity
SLC, UT
Joined September 2023
- Tweets338
- Following82
- Followers14
- Likes7
Hackers remotely manipulated supermarket fridges in France, pushing temperatures to 122°F. Spoiled food, reported fires, & millions in losses. Cyberattacks don't just steal data. They can disrupt the physical world. #IoTSecurity #Cybersecurity zurl.co/RnJkR
AI brings new opportunities & new risks as we use it every day. Shadow AI, unreliable answers, & the exposure of confidential data are growing concerns. Employees need approved tools & practical guidance, not just policies. #AISecurity #CyberAwareness zurl.co/k8YTl
AI agents reportedly made unauthorized edits to Wikipedia, attempted to misuse tools, & generated millions of requests. No breach was found, but the lesson is clear: autonomous AI needs boundaries, monitoring, & accountability. #Cybersecurity #AgenticAI zurl.co/2g3NB
You don't have to take an intimate photo for one to exist anymore. AI "nudify" tools can turn ordinary photos into fake explicit images used for bullying, harassment, or sextortion. The image may be fake. The harm isn't. #OnlineSafety #AI #Deepfakes 🔗zurl.co/nvI2W
A real Google login page doesn't always mean you're safe. Attackers can abuse OAuth permissions to gain Gmail/Drive access without stealing your password or bypassing MFA. Review your apps and AI agents.
🔗zurl.co/PuzGz #Cybersecurity #OAuth #GoogleWorkspace
That email from your boss could be fake. So could the invoice—and even the entire email conversation. Microsoft found 1M+ fraud emails in 3 days using executive/vendor impersonation & fabricated invoices. Don't trust the story. Verify the request.#AI zurl.co/8DeFu
A cyberattack cancels your flight. Who pays? A new DOT rule can treat cyberattacks as outside an airline’s control if it meets cybersecurity requirements. That may affect meals/hotels—but not necessarily your right to a refund. #Travel @Cybersecurity 🔗zurl.co/X9Osw
AI isn't just helping hackers anymore. Booz Allen testing found AI models can autonomously execute significant portions of a cyberattack—and some can complete the full kill chain. AI is making attacks faster, cheaper, & easier to scale.#Cybersecurity #CyberAttacks #AI #Infosec
Incident response isn't only technical. New CISA/FBI guidance says effective incident communications should be:
Immediate.Technical.Transparent.Accountable.Iterative. Know what you'll say, who can say it, and how you'll communicate—before the incident.zurl.co/m9Gqg
Fake CAPTCHAs are tricking people into installing malware themselves. If “Verify You’re Human” asks you to press Windows + R, open PowerShell/Terminal or paste a command—stop. That’s not a CAPTCHA. #Cybersecurity #ClickFix #CyberSafety #SocialEngineering zurl.co/MaQQ5
Finding more vulnerabilities and fixing them faster doesn't necessarily mean we're winning. The better metric: are entire classes of vulnerabilities becoming less common? AI can help us play whack-a-mole faster—or engineer the holes away. zurl.co/HhTRv
#Cybersecurity
Trail of Bits challenged GPT 5.6-Cyber to escape a VM. It escaped 3 times, eventually finding and chaining previously unknown vulnerabilities. Agent security can't rely on a VM boundary alone. We need to rethink containment. zurl.co/ohTar
#AISecurity #Cybersecurity
85% say compromised credentials are a primary attack path, yet only 19% continuously monitor active credentials & automatically remediate exposure. Authentication succeeded ≠ identity can be trusted.
#Cybersecurity #IAM zurl.co/jk8NY
My daughter has an Android head unit, so this caught my attention. Malware was delivered through a legitimate built-in updater, turning car infotainment systems into proxy botnet nodes. Trusted update mechanism=attack surface. 🔗zurl.co/Wqlw3#Cybersecurity #AutomotiveCybersecurity
CISA compromised both organizations. Only one stopped them. The difference wasn't preventing phishing. It was detecting & containing the intrusion before it escalated privileges and enabled lateral movement. A strong lesson in SOC effectiveness. zurl.co/IGclQ#Cybersecurity #SecOps
AliExpress caught using silent WebAudio processing as part of a much broader browser/device fingerprint.
No cookie required. No obvious media. No meaningful user visibility. The bigger story is how much a browser can reveal (running JavaScript). zurl.co/boGL0#Cybersecurity #Privacy
Enterprise AI has another governance problem: employee trust. Security, privacy, and model controls matter, but so do transparency, workforce impact, and change management. We need to govern what AI can do and manage the changes AI brings.
zurl.co/vW05b #AIGovernance
CTM360 found 3,000+ recruitment phishing URLs using fake interview portals, Browser-in-the-Browser logins, and real-time MFA relay. Correct credentials + successful MFA can still end in account takeover. 🔗zurl.co/Eq5zE #Cybersecurity #IdentitySecurity
MCP servers can become privileged non-human identities connecting AI agents to enterprise systems. That makes MCP security an IAM, secrets, AppSec, and AI governance problem, not just an AI problem.
🔗zurl.co/J2GVS #AISecurity #Cybersecurity
AI agents add another supply chain to secure: skills. Knowing an agent's identity and access isn't enough. We also need to know what instructions it trusts, where they came from, and what they can execute.
zurl.co/92yDK #AISecurity #AgenticAI


















